_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:46.5423883Z'/><EventRecordID>29353</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:46.541</Data><Data Name='ProcessGuid'>{43b9bf8b-6782-6962-c53e-000000000800}</Data><Data Name='ProcessId'>5964</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6782-6962-c43e-000000000800}</Data><Data Name='ParentProcessId'>2508</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:46.4381337Z'/><EventRecordID>29345</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:46.436</Data><Data Name='ProcessGuid'>{43b9bf8b-6782-6962-c13e-000000000800}</Data><Data Name='ProcessId'>5220</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6782-6962-c03e-000000000800}</Data><Data Name='ParentProcessId'>6176</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:46.3303283Z'/><EventRecordID>29337</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:46.329</Data><Data Name='ProcessGuid'>{43b9bf8b-6782-6962-bd3e-000000000800}</Data><Data Name='ProcessId'>4100</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6782-6962-bc3e-000000000800}</Data><Data Name='ParentProcessId'>5184</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:46.2341715Z'/><EventRecordID>29329</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:46.232</Data><Data Name='ProcessGuid'>{43b9bf8b-6782-6962-b93e-000000000800}</Data><Data Name='ProcessId'>6536</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6782-6962-b83e-000000000800}</Data><Data Name='ParentProcessId'>5440</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:46.1387477Z'/><EventRecordID>29321</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:46.137</Data><Data Name='ProcessGuid'>{43b9bf8b-6782-6962-b53e-000000000800}</Data><Data Name='ProcessId'>5700</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6782-6962-b43e-000000000800}</Data><Data Name='ParentProcessId'>2780</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:46.0448291Z'/><EventRecordID>29313</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:46.043</Data><Data Name='ProcessGuid'>{43b9bf8b-6782-6962-b13e-000000000800}</Data><Data Name='ProcessId'>6648</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6782-6962-b03e-000000000800}</Data><Data Name='ParentProcessId'>5932</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.9524639Z'/><EventRecordID>29305</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.950</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-ad3e-000000000800}</Data><Data Name='ProcessId'>1668</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-ac3e-000000000800}</Data><Data Name='ParentProcessId'>7120</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.8010462Z'/><EventRecordID>29293</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.799</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-a53e-000000000800}</Data><Data Name='ProcessId'>6720</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-a43e-000000000800}</Data><Data Name='ParentProcessId'>6568</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.6851344Z'/><EventRecordID>29285</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.683</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-a13e-000000000800}</Data><Data Name='ProcessId'>6996</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-a03e-000000000800}</Data><Data Name='ParentProcessId'>1044</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.5775715Z'/><EventRecordID>29277</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.576</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-9d3e-000000000800}</Data><Data Name='ProcessId'>5608</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-9c3e-000000000800}</Data><Data Name='ParentProcessId'>3844</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.4651392Z'/><EventRecordID>29269</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.464</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-993e-000000000800}</Data><Data Name='ProcessId'>5728</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-983e-000000000800}</Data><Data Name='ParentProcessId'>5484</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.3435803Z'/><EventRecordID>29261</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.342</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-953e-000000000800}</Data><Data Name='ProcessId'>5196</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-943e-000000000800}</Data><Data Name='ParentProcessId'>6756</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.2396110Z'/><EventRecordID>29253</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.238</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-913e-000000000800}</Data><Data Name='ProcessId'>5492</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-903e-000000000800}</Data><Data Name='ParentProcessId'>7164</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.1398353Z'/><EventRecordID>29245</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.138</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-8d3e-000000000800}</Data><Data Name='ProcessId'>6708</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-8c3e-000000000800}</Data><Data Name='ParentProcessId'>3528</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:45.0368675Z'/><EventRecordID>29237</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:45.032</Data><Data Name='ProcessGuid'>{43b9bf8b-6781-6962-893e-000000000800}</Data><Data Name='ProcessId'>5160</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6781-6962-883e-000000000800}</Data><Data Name='ParentProcessId'>5860</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.9121834Z'/><EventRecordID>29229</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.910</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-853e-000000000800}</Data><Data Name='ProcessId'>5200</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-843e-000000000800}</Data><Data Name='ParentProcessId'>6956</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.8078872Z'/><EventRecordID>29221</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.806</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-813e-000000000800}</Data><Data Name='ProcessId'>5964</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-803e-000000000800}</Data><Data Name='ParentProcessId'>6632</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.6977277Z'/><EventRecordID>29213</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.694</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-7d3e-000000000800}</Data><Data Name='ProcessId'>3032</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-7c3e-000000000800}</Data><Data Name='ParentProcessId'>5960</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.5911200Z'/><EventRecordID>29205</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.589</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-793e-000000000800}</Data><Data Name='ProcessId'>6528</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-783e-000000000800}</Data><Data Name='ParentProcessId'>5184</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.4910225Z'/><EventRecordID>29197</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.489</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-753e-000000000800}</Data><Data Name='ProcessId'>5180</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-743e-000000000800}</Data><Data Name='ParentProcessId'>5440</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.3711286Z'/><EventRecordID>29189</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.368</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-713e-000000000800}</Data><Data Name='ProcessId'>5796</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-703e-000000000800}</Data><Data Name='ParentProcessId'>3540</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.2583485Z'/><EventRecordID>29181</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.256</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-6d3e-000000000800}</Data><Data Name='ProcessId'>6452</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-6c3e-000000000800}</Data><Data Name='ParentProcessId'>1352</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.1520503Z'/><EventRecordID>29173</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.150</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-693e-000000000800}</Data><Data Name='ProcessId'>6460</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-683e-000000000800}</Data><Data Name='ParentProcessId'>6388</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:44.0471849Z'/><EventRecordID>29165</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:44.045</Data><Data Name='ProcessGuid'>{43b9bf8b-6780-6962-653e-000000000800}</Data><Data Name='ProcessId'>5428</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-6780-6962-643e-000000000800}</Data><Data Name='ParentProcessId'>3652</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:43.9401140Z'/><EventRecordID>29157</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:43.938</Data><Data Name='ProcessGuid'>{43b9bf8b-677f-6962-613e-000000000800}</Data><Data Name='ProcessId'>712</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677f-6962-603e-000000000800}</Data><Data Name='ParentProcessId'>6312</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:43.8244394Z'/><EventRecordID>29149</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:43.822</Data><Data Name='ProcessGuid'>{43b9bf8b-677f-6962-5d3e-000000000800}</Data><Data Name='ProcessId'>128</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677f-6962-5c3e-000000000800}</Data><Data Name='ParentProcessId'>3232</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:43.7072964Z'/><EventRecordID>29141</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:43.705</Data><Data Name='ProcessGuid'>{43b9bf8b-677f-6962-593e-000000000800}</Data><Data Name='ProcessId'>5976</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677f-6962-583e-000000000800}</Data><Data Name='ParentProcessId'>3844</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:43.5934791Z'/><EventRecordID>29133</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:43.591</Data><Data Name='ProcessGuid'>{43b9bf8b-677f-6962-553e-000000000800}</Data><Data Name='ProcessId'>5952</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677f-6962-543e-000000000800}</Data><Data Name='ParentProcessId'>7160</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:43.4810473Z'/><EventRecordID>29125</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:43.479</Data><Data Name='ProcessGuid'>{43b9bf8b-677f-6962-513e-000000000800}</Data><Data Name='ProcessId'>5636</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677f-6962-503e-000000000800}</Data><Data Name='ParentProcessId'>6124</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:43.3745655Z'/><EventRecordID>29117</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:43.372</Data><Data Name='ProcessGuid'>{43b9bf8b-677f-6962-4d3e-000000000800}</Data><Data Name='ProcessId'>4996</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677f-6962-4c3e-000000000800}</Data><Data Name='ParentProcessId'>3840</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:43.2818184Z'/><EventRecordID>29109</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:43.280</Data><Data Name='ProcessGuid'>{43b9bf8b-677f-6962-493e-000000000800}</Data><Data Name='ProcessId'>6660</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677f-6962-483e-000000000800}</Data><Data Name='ParentProcessId'>3020</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:43.1860235Z'/><EventRecordID>29101</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:43.185</Data><Data Name='ProcessGuid'>{43b9bf8b-677f-6962-453e-000000000800}</Data><Data Name='ProcessId'>6964</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677f-6962-443e-000000000800}</Data><Data Name='ParentProcessId'>6336</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:42.9731570Z'/><EventRecordID>29093</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:42.971</Data><Data Name='ProcessGuid'>{43b9bf8b-677e-6962-413e-000000000800}</Data><Data Name='ProcessId'>3524</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677e-6962-403e-000000000800}</Data><Data Name='ParentProcessId'>5072</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:42.5447779Z'/><EventRecordID>29085</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:42.543</Data><Data Name='ProcessGuid'>{43b9bf8b-677e-6962-3d3e-000000000800}</Data><Data Name='ProcessId'>6632</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677e-6962-3a3e-000000000800}</Data><Data Name='ParentProcessId'>6228</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:42.5242777Z'/><EventRecordID>29084</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:42.520</Data><Data Name='ProcessGuid'>{43b9bf8b-677e-6962-3c3e-000000000800}</Data><Data Name='ProcessId'>668</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677e-6962-393e-000000000800}</Data><Data Name='ParentProcessId'>7024</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:42.5161390Z'/><EventRecordID>29083</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 14:51:42.513</Data><Data Name='ProcessGuid'>{43b9bf8b-677e-6962-3b3e-000000000800}</Data><Data Name='ProcessId'>6424</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677e-6962-393e-000000000800}</Data><Data Name='ParentProcessId'>7024</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:42.3744627Z'/><EventRecordID>29074</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:42.373</Data><Data Name='ProcessGuid'>{43b9bf8b-677e-6962-363e-000000000800}</Data><Data Name='ProcessId'>6152</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677e-6962-353e-000000000800}</Data><Data Name='ParentProcessId'>2888</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:42.2307868Z'/><EventRecordID>29065</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:42.217</Data><Data Name='ProcessGuid'>{43b9bf8b-677e-6962-323e-000000000800}</Data><Data Name='ProcessId'>4304</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677e-6962-313e-000000000800}</Data><Data Name='ParentProcessId'>5700</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:42.1001024Z'/><EventRecordID>29057</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:42.098</Data><Data Name='ProcessGuid'>{43b9bf8b-677e-6962-2e3e-000000000800}</Data><Data Name='ProcessId'>6432</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677e-6962-2d3e-000000000800}</Data><Data Name='ParentProcessId'>6476</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:41.9510774Z'/><EventRecordID>29049</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:41.950</Data><Data Name='ProcessGuid'>{43b9bf8b-677d-6962-2a3e-000000000800}</Data><Data Name='ProcessId'>6856</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677d-6962-293e-000000000800}</Data><Data Name='ParentProcessId'>2876</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:41.8289598Z'/><EventRecordID>29041</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:41.827</Data><Data Name='ProcessGuid'>{43b9bf8b-677d-6962-263e-000000000800}</Data><Data Name='ProcessId'>7136</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677d-6962-253e-000000000800}</Data><Data Name='ParentProcessId'>6472</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:41.6882674Z'/><EventRecordID>29033</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:41.687</Data><Data Name='ProcessGuid'>{43b9bf8b-677d-6962-223e-000000000800}</Data><Data Name='ProcessId'>6752</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677d-6962-213e-000000000800}</Data><Data Name='ParentProcessId'>652</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:41.5347002Z'/><EventRecordID>29025</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:41.533</Data><Data Name='ProcessGuid'>{43b9bf8b-677d-6962-1e3e-000000000800}</Data><Data Name='ProcessId'>4396</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677d-6962-1d3e-000000000800}</Data><Data Name='ParentProcessId'>6320</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:41.2703326Z'/><EventRecordID>29016</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:41.266</Data><Data Name='ProcessGuid'>{43b9bf8b-677d-6962-1a3e-000000000800}</Data><Data Name='ProcessId'>4864</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677d-6962-193e-000000000800}</Data><Data Name='ParentProcessId'>6468</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:41.1200931Z'/><EventRecordID>29008</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:41.119</Data><Data Name='ProcessGuid'>{43b9bf8b-677d-6962-163e-000000000800}</Data><Data Name='ProcessId'>6384</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677d-6962-153e-000000000800}</Data><Data Name='ParentProcessId'>6396</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:40.9517907Z'/><EventRecordID>29000</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:40.950</Data><Data Name='ProcessGuid'>{43b9bf8b-677c-6962-123e-000000000800}</Data><Data Name='ProcessId'>2492</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677c-6962-113e-000000000800}</Data><Data Name='ParentProcessId'>4768</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:51:40.7883302Z'/><EventRecordID>28992</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:51:40.787</Data><Data Name='ProcessGuid'>{43b9bf8b-677c-6962-0e3e-000000000800}</Data><Data Name='ProcessId'>5820</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-677c-6962-0d3e-000000000800}</Data><Data Name='ParentProcessId'>5220</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>